NSE7 Practice Test 31 — 15 Questions

Question 1

A FortiGate administrator wants to use FortiAnalyzer to generate reports on traffic patterns for each VDOM separately. Which TWO configuration steps are required? (Choose two.)

Accepted Answer

Enable per-VDOM logging on the FortiGate. Per-VDOM logging must be enabled on the FortiGate to allow each VDOM to generate its own independent log stream. Without this setting, all VDOMs share a single log stream, making it impossible to separate traffic patterns per VDOM on FortiAnalyzer. Option E is correct because log forwarding from each VDOM to FortiAnalyzer is required to send the per-VDOM logs to the FortiAnalyzer for reporting.

Answer

Configure each VDOM to send logs to a different FortiAnalyzer

Answer

Disable logging on the FortiGate system

Answer

Create separate ADOMs for each VDOM on FortiAnalyzer

Question 2

A network administrator is deploying a FortiGate in transparent mode to replace an existing layer 2 switch. Which statement about transparent mode is true?

Accepted Answer

All interfaces operate at layer 2, and the FortiGate forwards traffic based on MAC addresses. In transparent mode, the FortiGate operates as a layer 2 bridge, forwarding traffic based on MAC addresses without performing routing. All interfaces are in the same broadcast domain, and the FortiGate inspects traffic at layers 3–7 while remaining transparent to the network. This allows it to replace a layer 2 switch while adding firewall functionality.

Answer

Transparent mode only supports static routing

Answer

Transparent mode requires VDOMs to be enabled

Answer

The FortiGate acts as a router and requires IP addresses on its interfaces

Question 3

An organization wants to implement Zero Trust Network Access (ZTNA) to secure access to an internal application. The application is hosted on a server with IP 10.1.1.100. Which component acts as the intermediary between users and the application in FortiGate ZTNA?

Accepted Answer

ZTNA proxy on FortiGate. FortiGate ZTNA uses a reverse proxy to forward user connections to internal applications. Users connect to the proxy, which verifies identity and posture before proxying traffic to the application server.

Answer

FortiClient EMS

Answer

ZTNA agent on the application server

Answer

ZTNA tags assigned to the application server

Question 4

A FortiGate admin runs 'diagnose debug application authd -1' but sees no output for LDAP authentication attempts. What is the MOST likely reason?

Accepted Answer

The FortiGate is in FIPS mode. The 'diagnose debug application authd -1' command enables verbose debug logging for the authentication daemon. However, on a FortiGate running in FIPS mode, many debug commands are restricted or produce no output to comply with security requirements. This is the most likely reason for observing no LDAP authentication debug output. Other possible reasons include running the command after authentication attempts have completed, but FIPS mode is a definitive system-level constraint.

Answer

The LDAP server is unreachable

Answer

The LDAP server timed out

Answer

Debug flow is not enabled

Question 5

A multi-VDOM FortiGate is running low on memory. The administrator suspects that the management VDOM is consuming excessive resources. How can the administrator limit the memory usage of the management VDOM?

Accepted Answer

Enable VDOM resource limits and configure a memory cap for the management VDOM. FortiGate VDOM resource limits allow an administrator to set a specific memory cap for each VDOM, including the management VDOM. By enabling VDOM resource limits and configuring a memory cap, the management VDOM is prevented from consuming excessive memory, ensuring fair resource allocation across all VDOMs. This is the only option that directly limits memory usage at the VDOM level without requiring hardware changes or disabling features.

Answer

Convert the management VDOM to a traffic VDOM

Answer

Move the management VDOM to a separate physical FortiGate

Answer

Disable unused features in the management VDOM

Question 6

An administrator is configuring SD-WAN rules to direct specific traffic types. Which TWO of the following criteria can be used in an SD-WAN rule to match traffic?

Accepted Answer

Destination IP address. Destination IP address (C) is a valid SD-WAN rule match criterion because SD-WAN rules can use destination IP address ranges or prefixes to steer traffic over specific transport interfaces or SD-WAN members. This allows administrators to route traffic to particular destinations (e.g., a branch office subnet or a cloud service) through preferred WAN links based on IP-based policy. Application (D) is also a valid criterion because SD-WAN rules can match traffic based on application signatures (e.g., Office365, YouTube) to apply appropriate steering policies, ensuring critical applications use optimal paths while non-critical traffic can be directed over lower-cost links.

Answer

Source interface

Answer

Time of day

Answer

URL category

Question 7

A FortiGate is acting as a SAML Service Provider (SP) for user authentication. Which TWO of the following are required for successful SAML SSO?

Accepted Answer

The IdP's metadata must be imported to the FortiGate. For SAML SP configuration on a FortiGate, the IdP's metadata (including the IdP's certificate and endpoints) must be imported to establish trust (B). Additionally, the SP (FortiGate) must have a certificate for signing SAML requests and optionally for encryption (E). Options A, C, and D are not required for SAML SSO to function.

Answer

The FortiGate must have a static public IP address

Answer

The users must be in the same Active Directory domain as the FortiGate

Answer

A pre-shared key must be configured

Question 8

An administrator is troubleshooting BGP and runs 'get router info bgp neighbors 10.0.0.1' and sees 'BGP state = Active'. The neighbor IP is reachable via ping. What is the most likely cause?

Accepted Answer

The BGP neighbor's remote-as is misconfigured. The BGP state 'Active' indicates that the router is actively trying to establish a TCP connection to the neighbor but is failing. Since the neighbor IP is reachable via ping (Layer 3 connectivity is fine), the most likely cause is a misconfiguration of the remote-as on one side, causing a BGP OPEN message mismatch (the received AS number does not match the expected remote-as). This prevents the TCP session from completing the BGP peering process.

Answer

The BGP update-source interface is missing

Answer

The BGP network statement is missing

Answer

The BGP router-id is not configured

Question 9

An administrator is troubleshooting a ZTNA application access issue. Users can authenticate but cannot reach the internal application via the ZTNA proxy. The FortiGate's ZTNA rule uses a tag requiring 'OS Type = Windows' and 'Antivirus = running'. The device meets both conditions. Which THREE possible reasons could cause the access failure?

Accepted Answer

The ZTNA proxy's destination is pointing to the wrong internal IP or port.. The device meets the ZTNA tag conditions (OS Type=Windows, Antivirus=running), so D (tag assignment) and E (FortiClient installation) are not the cause. Access failure can occur if: A) the ZTNA proxy's destination points to the wrong internal IP or port, B) the firewall policy for ZTNA traffic is not configured or is misordered, or C) the FortiGate's SSL certificate for the ZTNA proxy is not trusted by the client. These are the three most common reasons when posture is satisfied.

Answer

The user is not assigned the ZTNA tag in the FortiClient EMS portal.

Answer

The device does not have FortiClient installed.

Question 10

A FortiGate with SD-WAN has two members: MPLS (port1) and Broadband (port2). The performance SLA is configured to monitor latency and packet loss. The administrator notices that after a brief outage on the MPLS link, traffic fails over to Broadband but does not fail back when MPLS recovers. What is the likely cause?

Accepted Answer

The SD-WAN rule for the traffic has 'set failback disable'.. The 'set failback disable' command in the SD-WAN rule prevents traffic from automatically returning to the preferred MPLS link after it recovers. By default, failback is enabled, meaning traffic will revert to the higher-priority member once the performance SLA is satisfied again. When disabled, the FortiGate keeps traffic on the backup link indefinitely, which matches the described behavior.

Answer

The SLA threshold is set too aggressively, causing the link to be considered down long after recovery.

Answer

The Broadband link has a higher cost, so the FortiGate prefers to keep traffic there.

Answer

The SLA probe interval is longer than the outage duration, so the SLA never detected the outage.

Question 11

An administrator wants to use FortiGate to automatically block traffic if FortiEDR detects a threat on an endpoint. Which feature should the administrator configure?

Accepted Answer

Create an automation stitch with a trigger from FortiEDR and an action to block the source IP. FortiGate integrates with FortiEDR via automation stitches, which allow events from FortiEDR (such as a detected threat) to trigger automated actions on FortiGate, such as blocking the source IP of the compromised endpoint. This provides real-time, policy-driven threat response without manual intervention, leveraging the Fortinet Security Fabric. Option A is incorrect because a VPN tunnel is not required; FortiEDR and FortiGate communicate via APIs. Option B is incorrect because FortiGuard Outbreak Prevention is a separate service that provides threat intelligence, not direct endpoint detection integration. Option C is incorrect because a static route is unnecessary for the API-based communication.

Answer

Configure a VPN tunnel between FortiGate and FortiEDR

Answer

Enable FortiGuard Outbreak Prevention on the antivirus profile

Answer

Configure a static route to the FortiEDR management IP

Question 12

What is the primary function of Content Disarm and Reconstruction (CDR) in FortiGate's antivirus profile?

Accepted Answer

To remove active content and rebuild files to eliminate hidden threats. Content Disarm and Reconstruction (CDR) works by stripping active content (e.g., macros, scripts, OLE objects) from incoming files and rebuilding them into a safe, sanitized version. This eliminates hidden threats such as embedded exploits or malicious code that signature-based detection might miss, providing protection against zero-day and unknown attacks. Option D correctly identifies this core function of removing active content and rebuilding files to neutralize threats.

Answer

To detect and block zero-day malware using machine learning

Answer

To reconstruct files that were corrupted during transmission

Answer

To compress files for faster scanning

Question 13

A FortiGate administrator wants to implement ZTNA to control access to an internal application server. Users will access the application via FortiClient. Which configuration step is REQUIRED to allow FortiClient to forward traffic to the ZTNA gateway?

Accepted Answer

Configure a ZTNA gateway on the FortiGate with an access proxy rule for the application. To allow FortiClient to forward traffic to the ZTNA gateway, the FortiGate must be configured as a ZTNA gateway with an access proxy rule that maps the application to a specific hostname and port. FortiClient then connects to the ZTNA gateway's proxy address, which forwards traffic to the internal application server. Option A is incorrect because a CA-signed certificate is not required for FortiClient; FortiGate can use a self-signed certificate for ZTNA. Option B is incorrect because a firewall policy from WAN to the application server would bypass ZTNA and expose the server directly. Option D is incorrect because the application server does not need to trust FortiClient's IP range; ZTNA uses identity-based access, not IP-based.

Answer

Install a CA-signed certificate on FortiClient

Answer

Create a firewall policy from the WAN interface to the application server

Answer

Configure the application server to accept connections from FortiClient's IP range

Question 14

An administrator is troubleshooting a scenario where IPSec VPN tunnels between two FortiGates are flapping. The logs show Phase 1 is up but Phase 2 fails with 'no proposal chosen'. The remote FortiGate has multiple Phase 2 selectors configured. What is the most likely cause?

Accepted Answer

Mismatched Phase 2 proxy IDs (local/remote subnets).. The 'no proposal chosen' error during Phase 2, despite Phase 1 being up, indicates a mismatch in the IPsec security association (SA) parameters. Since the remote FortiGate has multiple Phase 2 selectors configured, the most likely cause is that the local and remote proxy IDs (local and remote subnets) do not match any of the configured selectors. Phase 2 negotiation uses these proxy IDs to define which traffic should be encrypted; if they don't align, the IKE SA cannot be established.

Answer

Mismatched pre-shared keys.

Answer

Dead Peer Detection (DPD) settings are too aggressive.

Answer

Certificate validation failure.

Question 15

An administrator is configuring SD-WAN and wants to ensure that voice traffic uses the lowest latency link. Which two configurations are required to achieve this? (Choose TWO.)

Accepted Answer

Configure a performance SLA with latency threshold. A performance SLA with a latency threshold allows FortiGate to measure real-time latency to a target server and mark the link quality. Option D is correct because an SD-WAN rule using the 'best quality' strategy will dynamically select the link with the lowest latency (as determined by the SLA) for voice traffic, ensuring optimal voice quality.

Answer

Configure a static route for the voice subnet

Answer

Set the SD-WAN rule to use 'manual' strategy

Answer

Enable NAT on the SD-WAN interface